Forensic mapping in a civil proceeding in South Africa

This paper discusses the application of forensic cartography in a civil arbitration case. This arbitration case stemmed from a hijacking of a freight of cigarettes on the 9 of May 2012. Forensic cartography in the form of a report was used to illustrate that the driver of a third-party logistics company was complicit with the crime syndicate that committed the hijacking. Cell phone data was used to map the communication between the various suspects and the driver. The time period of interest was between 15 December 2011 and 9 May 2012. The cellular base stations were used to map these communications in time and space. Based on the evidence provided it was clear that the driver of the thirdparty logistics company was complicit in committing the crime which led to the arbitration proceedings to be settled by the third-party logistics company in favour of the cigarette manufacturer. Further, it was concluded that the cartographic representation selection for forensic purposes is dictated by the specific case being investigated.


Introduction
This paper looks at the use of forensic mapping in a civil proceeding that emanated from a crime that occurred nine years ago in 2012. In the early morning hours of 9 May 2012, a truck belonging to a third-party logistics company transported a consignment of cigarettes for a cigarette manufacturer in Heidelberg, South Africa, and was hijacked for its consignment while in transit. The first author was involved in several cases in South Africa where forensic mapping was used in criminal proceedings such as the hijacking, kidnapping, rape and subsequent murder of a female and her male companion in 1998 (Schmitz et al., 2000), Taliep Petersen, a famous South African musician, murder in December 2006 (Schmitz et al., 2009), stock theft and the murder of a judge (Schmitz et al., 2013). The next few sub-sections discuss forensic mapping in general followed by an overview of the case in question concluding with the outline of the rest of the paper.

Forensic mapping
Forensic mapping is a part of forensic geography which came to the fore in the 1970s where geographers became involved as expert witnesses and consultants in civil and criminal cases (Lanegran 1978, Morgan and Bull 2007and Mazhari 2010. Forensic mapping or forensic cartography is not restricted to use in criminal and civil court cases but is also used in reconstructing historical maps for comparative purposes as illustrated by Bunn and Nolden (2018). The authors used forensic cartography to reconstruct 1859 compass survey to compare Lake Rotomahana and surrounds in 1859 in New Zealand with contemporary topographic maps (Bunn and Nolden, 2018). Another application of forensic mapping is the mapping of deaths at sea and on land of migrants in and around Mediterranean Sea (Lo Presti, 2019). Majdzadeh (2019) used forensic mapping to resurrect memories and sense of place after specific landmarks in Iran were destroyed shortly after the Iranian revolution in 1979. Schmitz, et al. (2013) indicated that the cartographic approach for forensic purposes is dictated by the specific case under investigation and prosecution. They illustrated this concept through four examples, namely a single map, a storyboard, multiple maps, and a report. The storyboard was a collection of maps in chronological order and the report consisted of several maps and a narrative. The aim of these approaches is to make complexity of the case easier to understand by using maps. All four approaches did result in successful prosecutions. Schmitz, et al. (2015) indicated that persons who are not skilled in reading maps find it easier to read space-time patterns in 2D, especially when a high number of suspects are involved as it was in this instance.
Owing to complexity of this crime, it was decided to go the report route which consisted of various maps, spacetime patterns in 2D, and a narrative.

The crime
As briefly mentioned in the opening paragraph, the hijacking occurred around one o'clock in the morning on the 9 th of May 2012. Some of the gang members followed the truck from the factory in Heidelberg, South Africa, to the location where the truck was hijacked as shown in Figure 1. The yellow dots in Figure 1 are the locations recorded by the onboard tracking device of the truck. The high density of the dots indicates where the hijacking took place. After the incident the trailer was separated from the truck. The driver was held "hostage" and forced to drive down to the Free State province where the truck was abandoned. The driver was taken to Pretoria and released. From the investigations which will be discussed in full, it transpired that the driver cooperated with the gang. The gang used their own truck to move trailer. It appears that the trailer was taken to two locations where the cargo was offloaded and then abandoned near Johannesburg where it was recovered by the police and the logistics company.

Civil proceeding
The theft of the consignment gave rise to both criminal and civil proceedings. The civil proceeding took the form of an arbitration as between the cigarette manufacturer, and the third-party logistics company ("the arbitration proceedings"). The question to be decided was which entity was to bear responsibility for the loss of the consignment of the cigarettes while in transit, based on the terms of the contract in place between the parties.

Rationale
The forensic mapping of the crime was done by the first author in 2012 and January 2013 and a report with maps showing cellular telephone usage and movements were given to the South African Police Service and the cigarette manufacturer. In November 2019 the co-authors requested that the first author conduct a further in-depth analysis using the available data to confirm that the driver was indeed involved with the gang and highlight other patterns of interest to the arbitration proceedings. The rest of the paper is as follows: the next section discusses the methodology used in the analysis, the results of the analysis and the paper ends with the conclusion and possible future research to refine the forensic mapping processes.

Methodology
The methodology for creating the forensic maps and the accompanying report are as follows: • The list of identified suspects and their cellular telephone numbers were provided by the police and the cigarette manufacturer's security services. These were cross checked with data from an analysis made by the police's Crime Intelligence section. The data from Crime Intelligence showed names and cellular telephone numbers. was analysed to determine whether the truck driver did in fact have communications with the gang members prior to the hijacking incident. • The extracted data on the 9 th of May 2012 for all the suspects and the driver were georeferenced to the cellular base stations to map movements and communications between them using GIS. The tracking data of the truck was made available to be used in the analysis. • From the mapped data in GIS communication and locational patterns were analysed including the profiling of the suspects. • These results were presented in final maps and a report was compiled that was submitted as evidence in the proceedings. Figure 2 illustrates the process followed in methodology to create forensic maps and report. There were 13 suspects, including the driver involved in the hijacking of the truck. The suspects are listed as Suspect 1 to Suspect 12 and the driver of the truck as the driver. The reason for anonymising the persons, is that they have not been prosecuted for the crime as yet and that their privacy needs to be respected. As indicated their names and cellular telephone numbers have been cross referenced with the analysis made by the Crime Intelligence unit of the police. Figure 3 shows an example such an analysis. The grey arrows show the direction of contact and number of contacts made. The red arrows show which base station was used by the suspects. The investigators from the South African Police Services subpoenaed the cellular telephone usage by each suspect and the driver for the period as indicated. These data sets were supplied to the first author for analysis. Included were the affidavits from the cellular service providers that the data was legally extracted for this investigation. This is necessary to secure the chain of evidence when submitted to court as evidence including the report and forensic maps. The next step was to determine the time periods of interest to the case. The first period of interest was between 15 December 2011 and 8 May 2012 the day before the hijacking incident. This to determine whether the driver had contact with the gang before the incident. The identified suspects were Suspect 3, Suspect 7 and Suspect 11. The next period of interest was the 9 th of May 2012, the day of the incident and it included the 12 suspects and the driver. All their cellular activity has been extracted including the communication between them. This was necessary to profile each of them with regards to their movement patterns and their communication with each other. The cellular base station was used to georeference the suspects and the driver in time and space. The following data was extracted from the cellular usage records, namely date, time of activity, type of activity, other party number, base station name. The base station name was used to obtain the coordinates of the base station. Figure 4 shows the georeferenced locations of Suspect 2.
The profiling was done for each of the suspects and the driver. The patterns of movement were established by combining each suspect and the driver. There were four patterns identified, namely the hijacking itself, the first offloading of the cargo, the second offloading of the cargo and the movement of the truck for abandonment and the release of the driver of the truck. The last step in the methodology was the preparation of the final maps and the compilation of the report for submission as evidence in the civil proceedings.

Results
Figures 5 and 6 are maps to orientate the reader to the provinces and some towns of interest to the discussion of the forensic maps. Figure 5 shows the provinces of South Africa and Figure 6 the towns of interest, the major roads and the provinces of interest.

The driver's involvement
The aim was to establish whether the driver had contact with some of the gang members before the incident to indicate collaboration with the gang. Although these identified communications were not mapped, it provided crucial evidence with regards to the driver's involvement in the hijacking and corroborated his confession given to the South African Police Service (before it was retracted). The contacts between the driver, Suspect 3, Suspect 7 and Suspect 11 between 15 December 2011 and 8 May 2012 were as follows: Communication between the driver and Suspect 3 started on 18 December 2012 and ended 8 May 2012, the day before the incident. The total number of calls between them was 102 times which includes the 10 calls on the 8 th of May 2012. Communication between the driver and Suspect 7 consisted of four calls with the last two calls between them on the 8 th of May 2012. Two calls were made between the driver and Suspect 11, the first call was in March 2012 and the last call in April 2012. From the aforementioned it confirms that the driver was involved and corroborated his confession given to the South African Police Service.

Activities on 9 May 2012
The hijacking of the truck occurred between 00:53:45 and 00:58:52 on the 9 th of May 2012. The location of the hijacking incident was between Heidelberg and Meyerton, see Figure 6, and Figure 1 shows the exact location of the incident. The location is indicated by the high concentration of yellow points along the route between Heidelberg and Meyerton. These points are the GPS coordinates from the truck's tracking device which are time stamped and captures activities such as stopping and opening of doors of the truck and trailer. At the hijacking location, the truck was unhooked from the trailer and the driver was taken "hostage" and forced to continue driving. In the meantime, the gang used their own truck and hooked the trailer onto it and drove off. The gang knew from the driver that truck carried the tracking device and not the trailer.
The activities on the 9 th of May 2012 are grouped as follows: • The hijacking itself that has been partly discussed in the introduction to this section. • The movement of the trailer from the hijacking location to an area between Alberton and Meyerton (see Figure 6 for orientation). • The movement of the truck towards Kroonstad and the release of the driver just outside of Pretoria (see Figure 6 for orientation). • The movement of the trailer to Thokoza/Vosloorus. Thokoza/Vosloorus is next to Katlehong in Figure 6.
• The recovery of the truck and the trailer.

The placement of suspects at the hijack location
The hijacking itself has been discussed in the introduction of this section. This subsection discusses the placement of suspects to the crime scene based on the base towers triggered during the commission of the hijacking of the truck. Figure 7 shows the various base stations that were used by the suspects near the cigarette manufacturer's depot in Heidelberg, South Africa, the route of the truck (green dots) and the alleged hijacking location. Based on the cell tower usage pattern obtained from the suspects' cell phone data close to the hijacking location, most of the suspects followed the truck from the depot to the location on the R42 as illustrated in Figure 1. Using the usage patterns the following cell towers were activated around the same time when the truck was followed and when the incident took place. These cellular base stations and the respective users are shown in Figure  7. From this pattern of cell tower usage during the times indicated, the following suspects can be placed at or near the hijacking location, they are Suspect 2, Suspect 3, Suspect 4, Suspect 6, Suspect 7, Suspect 10 and Suspect 11 as indicated in Figure 7.

Movement of trailer to a location between Alberton and Meyerton
At the hijacking location, as mentioned previously, the trailer was unhooked and hooked to the gang's own truck. Both the truck from the logistics company and the trailer with the gang's own truck moved towards Meyerton. At Meyerton as shown in Figure 8, the truck from the logistics company turned south and continued towards Kroonstad and the trailer turned north towards Alberton (see Figure  8). Based on the cellular base station usage, and as shown in Figure 8, suspects Suspect 2, Suspect 4, Suspect 10 and Suspect 11 were present in the area where the hijacking took place, and thereafter followed the trailer to Meyerton. Cellular base station usage shows that the four of them went to the area between Meyerton and Alberton which is circled in the second blue circle in Figure 8. The cellular base station usage also shows that suspects Suspect 5, Suspect 7, Suspect 8, Suspect 9 and Suspect 12 were also active in that area at that time. Based on their heavy cellular base station usage, it seems probable that this was an area where the trailer was taken in order for a portion of the cigarettes to be offloaded there.
Based on the subsequent movement and cellular base station usage by the suspects: Suspect 4, Suspect 7 and Suspect 11 it can be inferred that the suspects moved the trailer from the Meyerton/Alberton location at around 04:50, when it was moved to the location near Thokoza/Vosloorus which was the offloading point as indicated by SAPS and the cigarette manufacturer. This location is shown in Figure 8 as the 2nd offloading point. The suspects: Suspect 2, Suspect 5, Suspect 8, Suspect 9, Suspect 10 and Suspect 12 did not follow the trailer to Thokoza/Vosloorus but left the area around 05:20. The green arrow in Figure 8 is used to illustrate this. These suspects' cell phone data indicates that some of them returned to that area later during the day, the area being a mixture of residential areas and agricultural small holdings.

Movement of trailer to the location near Thokoza/Vosloorus
This location was identified by SAPS and the cigarette manufacturer. The activity of the cellular base stations around the location by the suspects confirms this location. This is indicated as the second offloading point and indicated as such in Figure 8. According to the cellular base station usage it seems that the trailer arrived there around 05:20. The following @ Hijacking spot: Suspect 2, Suspect 3, Suspect 4, Suspect 6, Suspect 7, Suspect 10, Suspect 11, @Area between Alberton and Meyerton: Suspect 4, Suspect 5, Suspect 7, Suspect 8, Suspect 9, Suspect 10, Suspect 11, Suspect 12, Suspect 2. 1 st offloading spot.
With truck and Driver: Suspect 3, Suspect 6 With Driver: Suspect 3, Suspect 6 Suspect 6's data indicates that he went to Pretoria. @ Offloading spot: Suspect 1, Suspect 4, Suspect 7, Suspect 11. 2 nd offloading spot. suspects based on their use of the surrounding cellular base stations were identified, namely Suspect 1, Suspect 4, Suspect 7 and Suspect 11. It appears that once the contents were offloaded, the trailer was taken to the location near Eikenhof, just south of Johannesburg (see Figure 6) as indicated in Figure 8. The time when the trailer was left near Eikenhof was difficult to determine owing to absence of cell tower usage data. Using the tracking data of the truck the trailer was recovered around 13:00 and left the area at 15:30 and arrived at the cigarette manufacturer's depot around 16:40. Returning to the second offloading location, it seems based on the data, that the suspects drove into various directions as indicated by the blue arrows in Figure 8. It could be that some of the suspects distributed the goods themselves to "clients". For example, Suspect 7 left the second offloading site and triggered a cell tower near Heidelberg at 07:48:07, then triggered a cell tower next to N3 at 08:34:55 and then turned towards the Vaal Dam next to Deneysville in Figure 8 triggering three cell towers between 08:52:19 and 10:48:26 before turning back to the West Rand and Soweto to west of Johannesburg, South Africa, driving around and triggering various cell towers between 12:37:23 and 14:03:48.

Movement of the truck and the driver after the hijacking incident
As mentioned in Section 3.2.2, the truck from the logistics company turned southwards at Meyerton towards Kroonstad. This movement of the truck is indicated by the green points from the truck's tracking device and the purple arrows in Figure 8. Based on the cellular base station usage and the tracking data from the truck, the following three persons drove to the location near Kroonstad, namely Suspect 3, Suspect 6 and the driver. It could be that either Suspect 3 or Suspect 6 was with the driver in the truck and the other suspect followed with a vehicle. The suspects needed their own vehicle in order to drive back to Gauteng ( Figure 6) together with the driver after abandoning the truck near Kroonstad. The persons then drove back towards Johannesburg and Pretoria as shown in Figure 8. Based on Suspect 6's cellular base station usage, he went to Pretoria before returning to the Thokaza/Vosloorus offloading site and then onto Heidelberg as indicated in Figure 8 by the brown arrow. The route taken by Suspect 6 based on his cell phone usage corresponds with the driver's confession that he was taken towards Pretoria and released near Mamelodi, Pretoria, on the Cullinan Rd as shown in Figure  9.

Conclusion
Based on the above analysis the following conclusions can be drawn: The cell phone data of the driver, with reference to each suspect's cell phone number, indicates that the driver had contact with Suspect 3, Suspect 7 and Suspect 11, as illustrated in Figure 2 and expanded upon in that section of the report. Calls made and received on the 8th of May 2012 between the driver, Suspect 3 and Suspect 7 could be expected in order to make the arrangements for the interception of the truck in the early morning hours of the 9th May 2012. Furthermore, there was no contact with them after the 9th of May 2012. These communication patterns indicate that it is probable that the driver was involved in the theft. Based on the analysis of the usage patterns by the suspects it appears that there is the possibility of two offloading sites, against the one offloading site as indicated by SAPS and the cigarette manufacturer as shown in Figure 3. The cell phone data of Suspect 6 is consistent with Suspect 6 being the person who took the driver to Pretoria and released the driver on the Cullinan road near Pretoria as indicated in the driver's affidavit to the investigating officer. The cell phone records of the suspects' patterns of usage suggest that some of the suspects distributed the stolen cigarettes themselves. Based on the communication patterns of the suspects, there seems to be a lot of contact between suspects which indicates that several vehicles were involved in this operation. These patterns further highlighted that Suspect 4, Suspect 7 and Suspect 11 played the key roles in the communications between suspects with regards to this operation. These links are reposted in Figure 10 for easy reference. Suspect 11 and Suspect 7 together with Suspect 3 are also the suspects who had contact with the driver before the 9th May.  Using the cell tower locations from the cell records of Suspect 4 appears to mirror the suspected movement of the 'hijacked' trailer based on the road network, and his key position within the group as indicated in the links between the suspects (see Figure 10), it seems that he was probably the driver of the truck that was used to move the trailer to the various locations as indicated. The overall conclusion is that the suspects did intercept the trailer and stole the cigarettes, and that the driver was part of this operation. Given the evidence that the driver was complicit, this then led to the arbitration proceedings being settled by the thirdparty logistics company, as the employee of the driver at all relevant times, in favour of the cigarette manufacturer. With regards to the forensic cartography the selection to use the report option with maps, including the space-time patterns in 2D and a narrative was successful in obtaining the settlement. Furthermore, it illustrates that the criminal case in question determines the forensic cartographic approach to be taken, as discussed in Section 1.1, to improve the possibility of obtaining a conviction or settlement. Thus, and a topic for future research, in the application of forensic cartography according to the authors there is no hard and fast method to apply. The case dictates which approach to use.